ALT-PU-2025-3852-3

Package update golang in branch c10f2

Version1.23.7-alt1

Published2026-02-04

Max severityMEDIUM

Severity:

Closed issues (5)

MEDIUM4.4

Уязвимость пакетов net/http, x/net/proxy и x/net/http/httpproxy языка программирования Go, позволяющая нарушителю оказать воздействие на конфиденциальность и доступность защищаемой информации

Published: 2025-07-02Modified: 2026-04-20

CVSS 3.xMEDIUM 4.4

CVSS:3.x/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

CVSS 2.0LOW 3.2

CVSS:2.0/AV:L/AC:L/Au:S/C:P/I:N/A:P

References

CVE-2025-22870

MEDIUM4.0

Уязвимость компонента crypto-elliptic языка программирования Golang, позволяющая нарушителю получить доступ к конфиденциальной информации

Published: 2025-03-27Modified: 2026-03-04

CVSS 3.xMEDIUM 4.0

CVSS:3.x/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS 2.0LOW 2.1

CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:N/A:N

References

CVE-2025-22866

MEDIUM4.0

Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the private key when P-256 is used in any well known protocols.

Published: 2025-02-06Modified: 2026-04-15

CVSS 3.xMEDIUM 4.0

CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

MEDIUM4.4

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.

Published: 2025-03-12Modified: 2026-04-16

CVSS 3.xMEDIUM 4.4

CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

References

GHSA-qxp5-gwg8-xv66

MEDIUM4.4

HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

Published: 2025-03-13Modified: 2026-04-24

CVSS 3.xMEDIUM 4.4

CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

References